Feed live

WordPress vulnerabilities - every known CVE across core, plugins, and themes

WordPress's attack surface comes mostly from its plugin and theme ecosystem, not core itself. Every disclosed CVE is scored, classified, and cross-referenced against the components that caused it.

Total CVEs tracked

343,038

All time

Critical · Active

11,213

CVSS ≥ 9.0

New · 14 days

3,039

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 17131–17160 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2022-45822	critical	10.0/10	WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection	Dec 5, 2022 3y ago
CVE-2022-35730	medium	4.3/10	WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)	Dec 4, 2022 3y ago
CVE-2022-40968	medium	4.8/10	WordPress 2kb Amazon Affiliates Store Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)	Dec 4, 2022 3y ago
CVE-2022-45842	medium	5.3/10	WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability	Nov 30, 2022 3y ago
CVE-2022-26366	medium	5.4/10	WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 30, 2022 3y ago
CVE-2022-38140	high	7.6/10	WordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.10 is vulnerable to Arbitrary File Upload	Nov 28, 2022 3y ago
CVE-2022-34654	medium	4.3/10	WordPress Manage Notification E-mails Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)	Nov 28, 2022 3y ago
CVE-2022-44737	medium	6.5/10	WordPress All In One WP Security plugin <= 5.1.0 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Nov 22, 2022 3y ago
CVE-2022-45363	medium	5.4/10	WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 22, 2022 3y ago
CVE-2022-41609	medium	6.4/10	WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-41155	medium	5.3/10	WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability	Nov 18, 2022 3y ago
CVE-2022-40216	medium	4.3/10	WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability	Nov 18, 2022 3y ago
CVE-2022-40130	medium	4.3/10	WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability	Nov 18, 2022 3y ago
CVE-2022-41618	low	3.7/10	WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability	Nov 18, 2022 3y ago
CVE-2022-41615	medium	6.1/10	WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-41634	medium	5.4/10	WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability	Nov 18, 2022 3y ago
CVE-2022-41135	medium	6.5/10	WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability	Nov 18, 2022 3y ago
CVE-2022-41655	medium	4.3/10	WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability	Nov 18, 2022 3y ago
CVE-2022-41643	medium	4.8/10	WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability	Nov 18, 2022 3y ago
CVE-2022-40963	medium	4.8/10	WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-42459	high	7.2/10	WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability	Nov 18, 2022 3y ago
CVE-2022-40695	medium	5.4/10	WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-42698	critical	9.8/10	WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability	Nov 18, 2022 3y ago
CVE-2022-42497	critical	10.0/10	WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary Code Execution vulnerability	Nov 18, 2022 3y ago
CVE-2022-41788	medium	5.4/10	WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability	Nov 18, 2022 3y ago
CVE-2022-43492	medium	4.3/10	WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability	Nov 18, 2022 3y ago
CVE-2022-44740	medium	5.4/10	WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities	Nov 18, 2022 3y ago
CVE-2022-44583	high	7.5/10	WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability	Nov 18, 2022 3y ago
CVE-2022-44584	critical	9.1/10	WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability	Nov 18, 2022 3y ago
CVE-2022-45082	low	3.4/10	WordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities	Nov 18, 2022 3y ago